notes: events/talks/kericonf26-d2-13-smith-spac-tsp

This data as json

path title type status classification words body
events/talks/kericonf26-d2-13-smith-spac-tsp Samuel M. Smith: SPAC and TSP (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 757 # Samuel M. Smith: SPAC and TSP (KERIConf 2026) **Abstract.** In his Day 2 breakout, Samuel M. Smith explained the design of SPAC (Secure Privacy, Authenticity and Confidentiality), the protocol from his white paper, and its relation to TSP (Trust Spanning Protocol), the Trust over IP generalization of it. He set out how the protocol separates privacy from confidentiality, why accountability within a context is a goal, and how a triple tunnel through two intermediaries protects metadata. The talk is for readers of the protocol specifications; the transcript begins after the opening minutes. ## Summary The transcript picks up as Smith restates the argument from his plenary: anyone a person interacts with repeatedly can eventually correlate them, so privacy depends on holding second parties accountable through economic, contractual, legal, regulatory or criminal means. The aim is relationships protected from third-party surveillance in which second parties answer for what is shared with them and for their own conduct, which he described as what a refuge or sanctuary provides. His model takes the first party's view. Third parties observe metadata, and because internet routing metadata is public and, in US law, unprotected, content can be encrypted but metadata cannot. Tunnels turn one layer's metadata into another layer's content. He defined privacy as third parties not knowing who is sharing, and confidentiality as third parties not knowing what was shared. SPAC seeks the best privacy possible without compromising authenticity or confidentiality, because weakening those two leads to fraud and identity theft, harms he considers larger for most people. He described relationships as pairs of AIDs (autonomic identifiers). AIDs are cryptonyms with high entropy and carry no correlating information on their own; correlation comes from the context in which identifiers are used. Partitions are sets of contexts whose relationships are mutually disjoint. Within a context, perfect correlation of an AID is desirable because it provides accountability and non-repudiation; between contexts, partitions should be as strong as possible. In questions he cited research from Brigham Young University (BYU) concluding that users want accountability rather than deniability, and agreed that voting needs a different protocol, with KERI used for the voter credential but not the vote. On cryptography, the protocol uses ESSR (encrypt sender, sign receiver), which he said is the only arrangement giving all four unforgeability properties for plaintext and ciphertext against third parties and receivers. He tied this to the warning in the IETF (Internet Engineering Task Force) hybrid public key encryption standard, RFC 9180, about key compromise impersonation, and said protocols that do not sign are exposed to it. The core of the protocol is a triple tunnel. Each endpoint holds three uncorrelated identifiers. The outer tunnel runs through two intermediaries with high fan-out and fan-in, so the outer identifiers act as cover identities; he contrasted covert cover identities, suited to persistence, with clandestine methods, which only last briefly. The second tunnel hides the true destination from the first intermediary, and the third keeps the endpoints hidden from both. He said three tunnels suffice, so two ordinary intermediaries replace many onion routers. Intermediaries keep traffic uniform with fixed-size packets. If the intermediaries collude they can only block a route, which multi-path sending addresses. A relationship formation subprotocol then lets parties create new identifier pairs and switch intermediaries inside a secure context, even daily, producing one-time contexts and new partitions on demand. ## Key terms SPAC, TSP, accountability, privacy versus confidentiality, cryptonym, context, partition, ESSR, triple tunnel, intermediary fan-out, covert versus clandestine, relationship formation ## Claims and their evidence - In SPAC, privacy is optimized only after strong authenticity and confidentiality are secured, never traded against them. [informative] - High-entropy AIDs are not themselves correlatable; correlation arises from the context of their use. [informative] - ESSR is the only combination of encryption and signing that provides all four unforgeability properties he listed. [presenter-reported] - Three nested tunnels through two intermediaries are enough to hide endpoint identities from both third parties and the intermediaries. [presenter-reported] - Colluding intermediaries can at most deny service on a route, which multi-path routing counters. [presenter-reported] ## Related SPAC white paper (Samuel M. Smith), Trust Spanning Protocol specification (Trust over IP), KERI specification, IETF RFC 9180 (Hybrid Public Key Encryption), BYU research on deniability, Samuel M. Smith's KERIConf 2026 plenaries ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (d2-13-samuel-smith-spac-tsp.md), minutes 0 to about 40:30 read; the transcript starts mid-argument, so the talk's opening is missing, and it ends about 2 minutes before the 42:25 duration. No quotations; paraphrase only. Not yet read by Mark.

Links from other tables